> ## Content Index
> Fetch the complete content index at: https://www.cybrsecmedia.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# DON’T WAIT: Engineering Outcomes Between Red Lines and Rules of Engagement
- URL: https://www.cybrsecmedia.com/dont-wait-engineering-outcomes-between-red-lines-and-rules-of-engagement/
- Published: 2026-06-24T12:07:37.000Z
- Updated: 2026-06-25T13:42:14.000Z
- Description: Danielle (DJ) Jablanski argues that critical-infrastructure owners must stop waiting for perfect regulation or deterrence and instead start today to map interdependencies, engineer fault-tolerant redundancy, and reduce the severity of inevitable cyber-physical impacts.
- Author: Lauren Andrus
- Tags: video, Critical Infrastructure Security, cybersecurity, industrial cybersecurity, Infrastructure Security, Leadership, OT Cybersecurity, OT.SEC.CON. 2026, OT Security

[Danielle Jablanski](https://www.linkedin.com/in/daniellejjablanski/?ref=cybrsecmedia.com), Cybersecurity Consulting Program Lead for Operational Technology (OT) Cybersecurity at STV, delivered a candid keynote urging asset owners across every sector to confront the reality that red lines and second-strike capability do not yet exist in cyberspace. Drawing on her prior roles at CISA and Nozomi Networks, she explained why traditional risk formulas fail for cyber-physical systems and outlined a practical “crawl-walk-run” approach—beginning with crown-jewel mapping, moving through dependency analysis, and ending with prioritized controls—that any organization can execute internally. Her central message: understand your interdependencies now, or risk losing control when the next state-sponsored campaign arrives.

## **Key takeaways**

- Critical infrastructure is already a frequent target in ongoing state competition; assume you will be hit and focus on impact reduction rather than perfect prevention.
- Probability × impact calculations are misleading; shift attention to loss-of-view versus loss-of-control scenarios and the integrity of command-and-control data.
- No sector has fully implemented ISA 62443; the CSF alone is insufficient for OT environments.
- Interdependency analysis must be sector-specific and cannot be solved by visibility tools, threat intel, or regulation in isolation.
- Use the six NIST 800-82 cyber-physical scenarios to drive internal tabletop exercises and reveal hidden single points of failure.
- Adopt a crawl-walk-run model: map infrastructure (crawl), document dependencies and shared-responsibility gaps (walk), then rank and apply controls by risk tier (run).
- Defense-in-depth remains the only reliable strategy; redundancies can be people, procedures, or offline equipment—not just new cybersecurity products.
- Board-level ownership and a documented maturity baseline are prerequisites for continuous improvement in non-regulated sectors.

[Subscribe to the CYBR.SEC.Media newsletter](#/portal/signup/free)

![HOU.SEC.CON CTA](https://s3.us-east-1.amazonaws.com/assets.cybersecmedia.com/HSC+CTA.jpg)